After f8c989a0c89a ("nfsd: release svc_expkey/svc_export with
rcu_work"), svc_export_put/expkey_put will call path_put with async
mode. This can lead some unexpected failure:
mkdir /mnt/sda
mkfs.xfs -f /dev/sda
echo "/ *(rw,no_root_squash,fsid=0)" > /etc/exports
echo "/mnt *(rw,no_root_squash,fsid=1)" >> /etc/exports
exportfs -ra
service nfs-server start
mount -t nfs -o vers=4.0 127.0.0.1:/mnt /mnt1
mount /dev/sda /mnt/sda
touch /mnt1/sda/file
exportfs -r
umount /mnt/sda # failed unexcepted
The touch above will finally call nfsd_cross_mnt, add refcount to mount,
and then add cache_head. Before this commit, exportfs -r will call
cache_flush to cleanup all cache_head, and path_put in
svc_export_put/expkey_put will be finished with sync mode. So, the
latter umount will always success. However, after this commit, path_put
will be called with async mode, the latter umount may failed, and if we
add some delay, umount will success too. Personally I think this bug and
should be fixed. We first revert before bugfix patch, and then fix the
original bug with a different way.
v1->v2:
1. do not change cache_check, instead add cache_check_rcu and use it in
c_show/e_show
2. the first patch has been applied
Yang Erkun (4):
SUNRPC: introduce cache_check_rcu to help check in rcu context
nfsd: no need get cache ref when protected by rcu
SUNRPC: no need get cache ref when protected by rcu
nfsd: fix UAF when access ex_uuid or ex_stats
fs/nfsd/export.c | 25 ++++++++++-------
include/linux/sunrpc/cache.h | 2 ++
net/sunrpc/cache.c | 53 ++++++++++++++++++++----------------
3 files changed, 46 insertions(+), 34 deletions(-)
--
2.46.1
